NSX Manager packet capture terminates automatically

Products

• VMware NSX Networking

Issue/Introduction

Symptoms:
When running a packet capture in NSX Manager, you experience this symptom:

The packet capture terminates automatically after 10 minutes.

Environment

VMware NSX-T Data Center
VMware NSX-T Data Center 3.x
VMware NSX-T Data Center 2.5.x

Cause

This issue occurs due to the NSX Manager not allowing packet capture session to run for a long period of time. If the Packet Capture value parameter is specified and larger than 10 minutes in the REST API, the fixed 10 minutes timeout value will take higher priority than the duration. 

Notes:

• The capture session automatically terminates after 10 minutes. This limitation is applied on both REST API and nsxcli in the NSX Manager.
• Running a packet capture for a long period of time generates a large pcap file which causes the host or node to crash.

For more information, see the NSX-T Data Center API Guide.

Resolution

To resolve this issue, run this command directly on the host:

nohup nsxcli -c start capture interface 69fc30c5-b4e9-4d54-b25c-718ba61b9b84 file test.pcap > /dev/null 2>&1 &

This command keeps the Packet Capture process continuously running.